The SuperCognit AI API: build, publish and monitor agents from your own code

SuperCognit is a no-code platform, and most people never need anything else: describe the agent, attach your knowledge, publish. But the moment you are running agents for a hundred customers, wiring conversations into a CRM, or building SuperCognit into your own product, clicking stops scaling. That is what the API is for — the same workspace, driven by your code.

One key, one header

Create an API key in your workspace and send it as an X-Api-Key header. Keys declare scopes — write is required for anything that is not a GET — and a key can be locked to a single product, in which case it cannot touch workspace-level resources such as tools, knowledge bases or webhooks. That is the whole authentication story: no OAuth dance, no SDK to install.

curl https://api.supercognit.com/v1/products \
  -H "X-Api-Key: $SUPERCOGNIT_API_KEY"

Create and publish an agent without opening the dashboard

A product — a chat agent or an MCP server — is created as a draft, configured, and then published. That is exactly the lifecycle the dashboard follows, which is why agencies use it to provision one agent per client straight from their own onboarding flow.

curl -X POST https://api.supercognit.com/v1/products \
  -H "X-Api-Key: $SUPERCOGNIT_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "kind": "chat_agent",
    "title": "Acme support",
    "intro": "Hi! Ask me anything about Acme.",
    "systemPrompt": "You answer Acme customer questions from the attached knowledge."
  }'

The response carries the new product's id and slug. From there you attach tools and knowledge bases, patch the prompt or the price, and publish it — all over the same API.

What the API covers

• Products — create, update, publish and unpublish chat agents and MCP servers.
• Tools — the workspace tool library: LLM, HTTP and static tools, their inputs, and which products use them.
• Knowledge bases — the knowledge behind your answers, and where each base is attached.
• Conversations — sessions and full transcripts, with the model and token counts on every message.
• Webhooks — endpoints, their delivery log and their retries.
• Wallet — the usage-credit balance and every top-up, charge and refund.
• End users — verify a chat session token server-side, so your app knows who it is talking to.

Events, pushed to you

Polling is fine for backfill, but realtime should arrive on its own. Register an endpoint and SuperCognit POSTs JSON as conversations happen: conversation.created when someone starts a conversation, message.created for each message, message.completed when the agent finishes its answer. Deliveries are retried up to five times with exponential backoff and logged with their response status, so nothing disappears quietly.

Every request is signed. Compute the HMAC-SHA256 of the RAW body with your endpoint secret and compare it to the X-Supercognit-Signature header — against the exact bytes you received, never a re-serialized copy of the JSON.

import { createHmac, timingSafeEqual } from "node:crypto";

const expected = "sha256=" + createHmac("sha256", WEBHOOK_SECRET).update(rawBody).digest("hex");
const valid = timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));

What teams build with it

REST for your systems, MCP for AI clients

The two developer surfaces answer different questions. The API is how your code drives SuperCognit. MCP is how AI clients — Claude, Cursor, your own agents — use what you publish. Both run on the same workspace, so a tool you build once is reachable from either side, and the platform's own MCP server exposes the same resources inside the assistant you already work in.

Start with the reference

The full reference is public and interactive at api.supercognit.com/docs, generated from an OpenAPI 3.1 document you can feed straight into a client generator. Create a key, run the first call above, and watch your workspace answer in JSON — free for 7 days.